MCP/API setup copies force `http://` base URLs that embed personal Bearer tokens

オープン 初心者向け
  • 何か問題がありますか？
#94 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@Robert0622 がすでに取り組んでいます。

2026年11月9日 から。

  • #132 @Robert0622 による — オープン

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
75/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
go, javascript
領域
api, authentication, security

調査の方向性

web/app/access.js の getPublicBaseURL() と、トークンを含む MCP および REST のテンプレートから始めます。web/app.js がホスト名を提供し、internal/httpapi/studio.go がそれを挿入します。デプロイ時の HTTPS リバースプロキシに関するガイダンスを読み、ページのスキームがコピーされる URL にどのように反映されるかを追ってください。安全なデプロイで、トークンを含むすべてのセットアップ URL に HTTPS が出力され、スキームの選択を対象としたテストで確認できれば完了です。

索引モデルが issue の本文から書いたものです。

説明

Summary

Access / MCP onboarding builds public base URLs with a hard-coded http:// scheme and interpolates the user’s newly created personal Bearer token into MCP JSON, curl samples, and one-click agent prompts. On deployments that terminate TLS at a reverse proxy while the studio page is reached over HTTPS, following those copied instructions sends long-lived API/MCP tokens in cleartext over HTTP.

Affected code (head c7114fca)

Location What the code does
web/app/access.js getPublicBaseURL() always returns 'http://' + domain — no location.protocol, no HTTPS branch
web/app/access.js Module-level PUBLIC_BASE_URL likewise prefixes http://
web/app/access.js accessMcpClientSpec / accessMcpAgentPrompt embed base + Bearer ${token}
web/app/access.js REST setup: AGENTFLOW_URL=${base} and curl with Bearer token
web/app/access.js MCP tab: same base + token in prompt, manual mcp.json, and curl tools/list
web/app/access.js Token reveal: MCP client spec / agent prompt rebuilt with getPublicBaseURL() + revealed token
web/app.js Domain from <meta name="agentflow-app-domain"> (hostname, no scheme)
internal/httpapi/studio.go stampStudioIndex injects AGENTFLOW_APP_DOMAIN / APP_DOMAIN as meta content (raw domain string)
docs/deployment.md Documents HTTPS reverse proxy in front of the service; AGENTFLOW_SECURE_COOKIES=true when HTTPS terminates at the proxy
.env.example Notes production HTTPS → AGENTFLOW_SECURE_COOKIES=true
Contrast Runner bind copy prefers HTTPS first (deploy/bind-cli.sh); preview UI has HTTPS upgrade helpers in runs.js — Access onboarding does not

Conditions

  1. User is logged in, opens Access (MCP / REST / Token reveal), and creates or reveals a personal token (state.revealedToken).
  2. UI copies snippets that set AGENTFLOW_URL=http://<domain> (or MCP url / curl URL) and Authorization: Bearer <token> using getPublicBaseURL().
  3. Deployment serves the studio over HTTPS at the edge while AGENTFLOW_APP_DOMAIN / APP_DOMAIN is a bare hostname (common TLS-terminated proxy layout per deployment docs). Backend may still speak HTTP to the proxy; that alone is fine — the issue is client instructions that force HTTP for token-bearing calls.
  4. User (or an agent following the pasted prompt) executes the copied HTTP endpoint.

No special attacker role is required beyond the victim following their own Access copy flow (self-inflicted cleartext token transport). Risk materializes when those instructions leave the HTTPS studio context (local agent, curl on another host, MCP client config).

User copy / follow steps (expected misuse path — not captured)

  1. Open Access → MCP (or REST / create Token).
  2. Create token / use “生成并复制” so the prompt or mcp.json contains a real Bearer token.
  3. Observe generated base: always http:// + domain (static reading of getPublicBaseURL; no location.protocol).
  4. Paste into Cursor/Claude/CodeBuddy/Codex or run the curl sample → client contacts http://… with the Bearer token.

Not claimed: MitM observed on a wire, or that every deployment is HTTPS. Claim is: templates force HTTP, which is unsafe whenever the public entry is HTTPS / TLS-terminated.

Impact

  • Cleartext exposure of long-lived personal API/MCP tokens on the path between client and the HTTP origin named in the snippet (MitM, captive portals, corporate proxies).
  • Automated agents that follow the prompt will prefer the insecure endpoint.
  • Mixed-content / confusing breakage is secondary; the security issue is token transport scheme.

Suggested fix

  1. Derive scheme from window.location.protocol, or from a config/meta that may include https:// (e.g. align with LOOPFORGE_PUBLIC_URL / public URL scheme).
  2. Never downgrade an HTTPS studio page to http:// for token-bearing endpoints.
  3. Align Access/MCP copy with runner install guidance that already prefers HTTPS.
  4. Add a unit/UI test that locks scheme selection for token-bearing templates (HTTPS page must not emit http:// bases).

Acceptance criteria

  • Token-bearing setup URLs use HTTPS whenever the studio page or configured public base is HTTPS.
  • No Access/MCP generated snippet forces http:// for a secure deployment.
  • Focused test locks scheme selection for token templates.
  • Issue text does not claim a packet capture unless one is separately recorded.
主要言語
Go
スター
141
フォーク
28
平均マージ
2日 15時間
マージ済み PR（30日）
41

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

Tencent/LoopForge のほかの issue

Tencent/LoopForge の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。